WIP - Adding AWS Greengrass - Parsec Demo

.gitignore

@@ -0,0 +1,9 @@
+*.iml
+target
+dependency-reduced-pom.xml
+.flattened-pom.xml
+.idea
+.run/gg_*
+.run/parsec_docker_run.run.xml
+secrets.env
+

.gitmodules

@@ -0,0 +1,8 @@
+[submodule "greengrass_parsec_workshop/parsec-client-java"]
+	path = greengrass_parsec_workshop/parsec-client-java
+	url = https://github.com/parallaxsecond/parsec-client-java.git
+	branch = main
+[submodule "greengrass_parsec_workshop/aws-greengrass-parsec-provider"]
+	path = greengrass_parsec_workshop/aws-greengrass-parsec-provider
+	url = https://github.com/56kcloud/aws-greengrass-parsec-provider.git
+	branch = main

greengrass_parsec_workshop/.dockerignore

@@ -0,0 +1,15 @@
+build_demo.sh
+greengrass_demo/.gitignore
+secrets.env
+target
+.gitignore
+.git
+.cache
+**/parsec_docker_cache
+**/target
+.idea
+*.iml
+.run
+.flattened-pom.xml
+*~
+.DS_Store

greengrass_parsec_workshop/README.md

@@ -9,7 +9,22 @@ Before you begin you should be family of both PARSEC and AWS Greengrass, have at
 ## DEMO
 Located in this workshop is a "out of the box" demo setup which build and deploys the complete solution from the workshop learning steps, it is used as both a learning guide and short example when demonstrating the use of Parsec with AWS Greengrass
 
-### How to get started
+Demo HOWTO
+
+- git pull repo, and checkout building_parsec_workshop
+- cd into greengrass_parsec_workshop/
+- create secrets.env file with the following:
+   AWS_ACCESS_KEY_ID=
+   AWS_SECRET_ACCESS_KEY=
+   AWS_REGION=eu-central-1
+
+- run ./build_demo.sh (it should build and then run)
+- Please note: (Can take up to 11mins based on how long the AWS CRT and Device SDK container builds as they are building from a branch that hasn't been upstreamed yet (op-key-prototype))
+- Once the build is finished it will go directly into provisioning Greengrass, and restart with the parsec plugin where the provisioning step as stored the private key in parsec service (EMbed crypto backend)
+- If you visit the Greengrass console here: https://eu-central-1.console.aws.amazon.com/iot/home?region=eu-central-1#/greengrass/v2/cores 
+- You should now see your device listed "<hostname/username>-greengrass-parsec"
+
+### How to get started in development
 
 To get started you will need the following, an aarch64 or x86 device or your local computer, an active AWS account and your API credentials, Github access configurated locally
 The demo.sh file will do the following
@@ -33,10 +48,10 @@ TPM's currently being implemented as part of this workshop
 - Qualcomm SPU240 HW RoT / SPU (WIP)
 - EDK II UEFI SoftTPM (new concept) 
 
-### Example of 
+### Example of Demo
 
 Example of 3 screens, PArsec Service, Greengrass Local Debug Console showing 
-<img src="docs/56kcloud_parsec_greengrass_onrb5_sucess.png" alt="56K.Cloud Logo" height="1024">
+<img src="docs/56kcloud_parsec_greengrass_onrb5_sucess.png" alt="56K.Cloud Logo" height="800">
 
 ## Contributions
 

greengrass_parsec_workshop/build_demo.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 pushd $(dirname $0)
-md5_cmd=md5
+md5_cmd=md5sum
 
 if ! test -x /sbin/md5; then
   md5_cmd=md5sum
@@ -15,7 +15,12 @@ function update_git() {
   # Need to update the protobuf from parsec
   git submodule init
   git submodule update
-
+  pushd ./aws-greengrass-parsec-provider/
+  git submodule init
+  git submodule update
+  pushd ./aws-greengrass-parsec-provider/parsec-client-java/
+  git submodule init
+  git submodule update
 }
 
 function dirty_build_on_new_comits() {
@@ -30,13 +35,14 @@ function dirty_build_on_new_comits() {
 }
 
 function build_greengrass_patched() {
-pushd examples/greengrass/parsec-greengrass-run-config/docker/
+pushd ./aws-greengrass-parsec-provider/parsec-greengrass-run-config/docker/
 docker build . \
        --build-arg BUILD_TS=${DIRTY_TS} \
        --tag parallaxsecond/greengrass_patched:latest \
        --progress plain
 popd
 }
+
 function copy_deps_from_greengrass_patched_to_local() {
   docker run -v ~/.m2/repository:/host_m2_repository parallaxsecond/greengrass_patched:latest \
   /bin/bash -c "cp -r ~/.m2/repository/* /host_m2_repository"
@@ -49,6 +55,7 @@ popd
 }
 
 function build_greengrass_with_provider() {
+  echo "Build of Greengrass and Parsec Plugin started..."
   docker build . -f greengrass_demo/Dockerfile --tag parallaxsecond/greengrass_demo:latest  --progress plain
 }
 

greengrass_parsec_workshop/greengrass_demo/Dockerfile

@@ -1,8 +1,8 @@
 FROM parallaxsecond/greengrass_patched:latest as from_source_builder
 COPY ./ /project
-RUN cd /project && \
+RUN cd /project/aws-greengrass-parsec-provider && \
      ./mvnw clean install -DskipTests=true -Dcontainers.skip=true
 
 FROM parallaxsecond/greengrass_patched:latest
-COPY --from=from_source_builder /project/examples/greengrass/parsec-greengrass-plugin/target/aws.greengrass.crypto.ParsecProvider.jar /provider.jar
+COPY --from=from_source_builder /project/aws-greengrass-parsec-provider/parsec-greengrass-plugin/target/aws.greengrass.crypto.ParsecProvider.jar /provider.jar
 COPY greengrass_demo/config.yml /greengrass/

greengrass_parsec_workshop/parsec-testcontainers/.gitignore

@@ -0,0 +1 @@
+parsec_docker_cache

greengrass_parsec_workshop/parsec-testcontainers/build.sh

@@ -0,0 +1,15 @@
+#!/bin/bash -e
+docker_cache=parsec_docker_cache
+
+CACHE_CONFIG=""
+if (docker buildx inspect |grep "Driver: docker-container"); then
+  CACHE_CONFIG=" --set *.cache-from=type=local,src=${docker_cache} --set *.cache-to=mode=max,type=local,dest=${docker_cache}_new"
+fi
+
+# shellcheck disable=SC2086
+docker buildx bake ${CACHE_CONFIG} \
+  --progress plain \
+  --load
+
+rm -rf ${docker_cache} || true
+mv ${docker_cache}_new ${docker_cache} || true

greengrass_parsec_workshop/parsec-testcontainers/docker-bake.hcl

@@ -0,0 +1,38 @@
+group "default" {
+  #targets = ["parsec", "parsec_0.7.0", "parsec_0.8.1"]
+  targets = ["parsec_0.8.1"]
+}
+target "generic" {
+  context = "."
+  args = {
+    REGISTRY = "parallaxsecond"
+  }
+}
+target "parsec" {
+  inherits = ["generic"]
+  context = "./parsec"
+  args = {
+    PARSEC_BRANCH = "main"
+  }
+  tags = [
+    "parallaxsecond/parsec:latest"
+  ]
+}
+target "parsec_0.8.1" {
+  inherits = ["parsec"]
+  args = {
+    PARSEC_BRANCH = "0.8.1"
+  }
+  tags = [
+    "parallaxsecond/parsec:0.8.1"
+  ]
+}
+target "parsec_0.7.0" {
+  inherits = ["parsec"]
+  args = {
+    PARSEC_BRANCH = "0.7.0"
+  }
+  tags = [
+    "parallaxsecond/parsec:0.7.0"
+  ]
+}

greengrass_parsec_workshop/parsec-testcontainers/parsec/Dockerfile

@@ -0,0 +1,72 @@
+ARG REGISTRY
+FROM amazonlinux:2 as builder
+
+RUN set -e -x; \
+    yum install -y git gcc shadow-utils cmake3 make gcc-c++ pkgconfig clang-devel;\
+    rm -rf /root/.cache && \
+    yum clean all && \
+    rm -rf /var/cache/yum && \
+    rpm --rebuilddb && \
+    ln -s /usr/bin/cmake3 /usr/bin/cmake
+
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+
+# Workaround for incorrect aarch64 entry in cargo build
+RUN ln -s /usr/bin/gcc /usr/bin/aarch64-linux-gnu-gcc
+
+ARG PARSEC_TOOL_VERSION=0.4.0
+RUN set -e -x; \
+    source $HOME/.cargo/env; \
+    git clone https://github.com/parallaxsecond/parsec-tool; \
+    cd parsec-tool; \
+    git checkout ${PARSEC_TOOL_VERSION}; \
+    cargo install --path .; \
+    cd ..; \
+    rm -rf parsec-tool
+
+ARG PARSEC_BRANCH=0.8.1
+ARG PARSEC_FEATURES="cryptoauthlib-provider,mbed-crypto-provider,unix-peer-credentials-authenticator,direct-authenticator"
+RUN set -e -x; \
+    source $HOME/.cargo/env; \
+    git clone https://github.com/parallaxsecond/parsec; \
+    cd parsec; \
+    git checkout ${PARSEC_BRANCH}; \
+    cargo install --features "${PARSEC_FEATURES}" --path .; \
+    cd ..; \
+    rm -rf parsec
+
+ARG PARSEC_UID=4000
+ARG PARSEC_GID=4000
+RUN set -e -x; \
+    groupadd -g ${PARSEC_GID} parsec; \
+    useradd -u ${PARSEC_UID} -g ${PARSEC_GID} -d /home/parsec parsec; \
+    mkdir -p /var/lib/parsec /home/parsec /run/parsec /etc/parsec /usr/libexec/parsec; \
+    chmod 700 /var/lib/parsec /etc/parsec /usr/libexec/parsec; \
+    chmod 755 /run/parsec;
+
+FROM amazonlinux:2 as run
+ENV RUST_LOG=info
+ARG PARSEC_UID=4000
+ARG PARSEC_GID=4000
+
+RUN yum install -y socat && \
+    rm -rf /root/.cache && \
+    yum clean all && \
+    rm -rf /var/cache/yum && \
+    rpm --rebuilddb
+
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+COPY --from=builder /root/.cargo/bin/parsec* /usr/bin/
+COPY config.toml /etc/parsec/
+COPY --from=builder --chown=${PARSEC_UID}:${PARSEC_GID} /usr/libexec/parsec /usr/libexec/parsec
+COPY --from=builder --chown=${PARSEC_UID}:${PARSEC_GID} /var/lib/parsec /var/lib/parsec
+COPY --from=builder --chown=${PARSEC_UID}:${PARSEC_GID} /home/parsec /home/parsec
+COPY --from=builder --chown=${PARSEC_UID}:${PARSEC_GID} /run/parsec /run/parsec
+COPY --from=builder --chown=${PARSEC_UID}:${PARSEC_GID} /etc/parsec /etc/parsec
+
+# FIXME volume mount problem
+# Volumes are mounted as root first
+#USER parsec:parsec
+WORKDIR "/home/parsec"
+CMD ["parsec", "-c", "/etc/parsec/config.toml"]

greengrass_parsec_workshop/parsec-testcontainers/parsec/config.toml

@@ -0,0 +1,22 @@
+[core_settings]
+log_timestamp = true
+log_error_details = true
+allow_root = true
+
+[listener]
+listener_type = "DomainSocket"
+timeout = 200 # in milliseconds
+socket_path = "/run/parsec/parsec.sock"
+
+[authenticator]
+auth_type = "UnixPeerCredentials"
+admins = [ { name = "root" }, { name = "parsec" } ]
+
+[[key_manager]]
+name = "on-disk-manager"
+manager_type = "OnDisk"
+store_path = "/var/lib/parsec/mappings"
+
+[[provider]]
+provider_type = "MbedCrypto"
+key_info_manager = "on-disk-manager"

greengrass_parsec_workshop/parsec-testcontainers/pom.xml

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.parallaxsecond</groupId>
+        <artifactId>parsec-java</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+        <relativePath>..</relativePath>
+    </parent>
+    <artifactId>parsec-testcontainers</artifactId>
+    <dependencies>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>1.16.2</version>
+        </dependency>
+    </dependencies>
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+        <containers.skip>false</containers.skip>
+    </properties>
+    <build>
+        <plugins>
+            <plugin>
+                <!-- using exec plugin since fabric8 uses jffi not supported on m1 yet -->
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>exec-maven-plugin</artifactId>
+                <version>3.0.0</version>
+                <executions>
+                    <execution>
+                        <id>buildx</id>
+                        <goals>
+                            <goal>exec</goal>
+                        </goals>
+                        <phase>package</phase>
+                        <configuration>
+                            <skip>${containers.skip}</skip>
+                            <executable>./build.sh</executable>
+                            <workingDirectory>${project.basedir}</workingDirectory>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>